CVE-2026-18171

Executive Summary

CVE-2026-18171 is an incorrect-authorization vulnerability (CWE-863) in Docker Sandboxes (sbx) that voids the read-only contract for host directories attached to in-guest containers. When an operator mounts a host directory with read-only intent, the read-only flag is applied only to the in-guest container bind, while the underlying virtio-fs host-edge grant is added to the sandbox policy-share allowlist with no access mode — leaving the directory writable at its shared-export path. Unprivileged code inside the sandbox can derive that shared-export path and write to a host directory the operator explicitly attached read-only, enabling host filesystem tampering that may lead to privilege escalation or cross-tenant compromise. The CVE is currently unpatched, has no public PoC, is not listed on CISA KEV, and carries a negligible EPSS score (0.00105).

Technical Analysis

The vulnerability resides in the mount authorization model of Docker Sandboxes (sbx), the isolation layer used to execute untrusted workloads in a virtualized environment. The operator attaches a host directory to a sandbox with read-only intent. The description clarifies that this read-only intent is enforced at a single layer only: the in-guest container bind. The underlying host-edge grant used by virtio-fs — the paravalirtualized shared filesystem that mediates directory access between the host and the guest VM — is added to the sandbox's policy-share allowlist without an associated access mode. In effect, two authorization records are created for the same directory: one read-only view visible inside the guest, and one writable grant at the virtio-fs host edge that is never constrained.

This is a textbook CWE-863 (Incorrect Authorization) flaw: the security decision (read-only enforcement) is applied to the wrong object (the shadow bind inside the guest) rather than to the authoritative object (the host-edge export). The allowlist entry lacks an access-mode binding, so the read-only intent is never propagated to the layer where access is actually mediated. As a result, the directory remains writable at its shared-export path — the host-side mount point through which virtio-fs exposes the directory to the guest.

The attack surface is defined by the trust boundary between unprivileged guest code and the host kernel. Because the flaw is an access-mode omission rather than a memory-safety bug, no kernel exploit is required: the attacker only needs to resolve the shared-export path. The NVD description states that unprivileged code inside the sandbox can "derive that path," which implies the path is discoverable from guest context — for example, by enumerating the guest's mount table or procfs interface. Once the underlying writable path is known, ordinary file-write operations succeed despite the operator's read-only intent, because enforcement never happens at the host edge.

No specific function names, file paths, or API parameters are disclosed in the NVD description or CNA title, and no vulnerability implementation details should be inferred beyond the mechanism described. What is known with certainty is the authorization gap: read-only intent is scoped to the in-guest bind only, the virtio-fs host-edge grant is allowlisted with no access mode, and the shared-export path remains writable.

Deployments most at risk are multi-tenant container platforms, CI/CD pipelines, managed sandboxing services, and any environment where Docker Sandboxes are used to execute untrusted or semi-trusted code while exposing host directories — configuration, source trees, credentials, or artifact caches — as read-only inputs. The vulnerability converts a read-only dependency into a writable one, undermining the isolation guarantees operators rely on when feeding host data into sandboxed workloads.

Exploitation Scenarios

No public PoC or exploit code has been observed for CVE-2026-18171 as of this writing. The attack chain below is inferred strictly from the vulnerability class described in the NVD entry (CWE-863, incorrect authorization on a mount grant) and should be treated as analytic inference, not confirmed tooling.

1. Reconnaissance / target identification. The attacker is already executing as unprivileged code inside the sandbox — e.g., untrusted source code submitted to a CI pipeline, a compromised workload running in a sandboxed container, or a malicious payload delivered to a managed sandboxing service. Target identification consists of enumerating the guest mount environment to discover which backing directories correspond to operator-attached host mounts. Specifically, the attacker inspects mount metadata associated with virtio-fs to identify the shared-export path that is backed by the allowlisted but unrestricted host-edge grant.

2. Flaw trigger. The read-only restriction is absent at the host edge. The attacker opens the derived shared-export path with write intent (file-open operations equivalent to O_WRONLY, O_RDWR, or O_CREAT at the syscall level). No memory-corruption, race condition, or kernel bug is required — the authorization check simply does not exist at the enforcement layer. The in-guest container bind may still report read-only, which means conventional reads of the mount flags fail to expose the bypass and may mislead host-side monitoring.

3. Payload / execution method. At the vulnerability-class level, the attacker performs ordinary file-write operations on the shared-export path: creating new files, appending to existing files, or truncating and rewriting content. The specific content depends on the writable directory's role on the host. Plausible targets, without speculating on any concrete path names, include host configuration files consumed by a host service, scheduled-job or startup scripts, SSH key material, build inputs or artifacts in a CI root, and any mounted credential store. The payload is the modified or planted file itself, not an injected code blob.

4. Post-exploitation impact. Successful writes are persistent on the host filesystem and survive sandbox teardown. If the modified directory feeds a host process — a supervisor, cron-equivalent task, or service daemon — the attacker can escalate to host-level code execution or at minimum achieve persistent host data tampering. In multi-tenant configurations, the blast radius extends to any workload reading from the same host directory. Downstream effects may include supply-chain poisoning of build artifacts, credential compromise, and lateral movement from the sandbox host into adjacent infrastructure.

Impact Assessment

The business impact of CVE-2026-18171 is driven by the violation of a fundamental isolation guarantee rather than by the severity of any single write primitive. The vulnerability turns a read-only host mount into a writable one from the perspective of sandboxed code, which directly breaks the integrity of host data and the trust model of Docker Sandboxes.

Affected systems are all Docker Sandbox (sbx) deployments where operators attach runtime host mounts with read-only intent. Given the absence of a version range, patch evidence, or vendor advisory, the affected population cannot be scoped precisely, and all current sbx deployments using read-only host mounts should be considered potentially exposed.

Blast radius is host-wide and potentially cross-tenant. A single unprivileged foothold in one sandbox can modify host directories that other sandboxes or host services consume, producing a data-integrity cascade across tenants. In CI/CD or managed-code-execution products, the writable mount could allow an untrusted job to tamper with shared caches or input repositories, affecting every build that references them. Availability can be degraded by destructive file writes or by rendering host configuration invalid.

CVSS scoring is not available (N/A vector and score), so no qualitative severity rating can be cited from the CVE record. EPSS places this at 0.00105 (1.2% percentile), indicating negligible exploit likelihood in the near term; the CVE is absent from CISA KEV and no in-the-wild exploitation has been reported. However, the unpatched status combined with the low technical difficulty of the bypass — a simple access-mode omission rather than a complex memory-safety flaw — suggests the risk profile may shift upward if the shared-export path discovery technique becomes widely known.

Detection Guidance

Detection of CVE-2026-18171 is challenging because the underlying behavior (file writes to a directory the operator mounted read-only) is not anomalous to the host filesystem layer — the host edge simply sees legitimate write syscalls against an unrestricted grant. The most reliable visibility comes from two signals: (a) guest-side processes enumerating virtio-fs mount metadata to derive the shared-export path, and (b) host-side writes landing in directories that are supposed to be read-only per the operator's declared policy. The rules below focus on these two signals and use placeholders for the actual shared-export path list, which must be populated from the platform's mount configuration.

Sigma Rule

title: CVE-2026-18171 Docker Sandbox Read-Only Host Mount Write Bypass
id: 7c9e5a31-6c2d-4e1b-8b8f-9f0a5c5e3a11
status: experimental
description: >
    Detects file-open syscalls with write intent issued by sandboxed processes
    against the shared-export paths that back read-only host mounts in Docker
    Sandboxes. Exploitation of CVE-2026-18171 succeeds because the virtio-fs
    host-edge grant is allowlisted in the policy-share list without an access mode.
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-18171
tags:
    - attack.t1068
    - cve.2026-18171
    - cwe.863
logsource:
    product: linux
    service: auditd
detection:
    selection_write:
        type: SYSCALL
        syscall: openat
        key: sbx_ro_mount          # audit key assigned to the sandbox shared-export watch
        a0|contains:
            - '0x41'               # O_WRONLY | O_CREAT
            - '0x42'               # O_RDWR   | O_CREAT
            - '0x241'              # O_WRONLY | O_CREAT | O_TRUNC
            - '0x242'              # O_RDWR   | O_CREAT | O_TRUNC
            - '0x401'              # O_WRONLY | O_CREAT | O_APPEND
    filter_known_good:
        auid: 0
    condition: selection_write and not filter_known_good
falsepositives:
    - Explicitly privileged workloads that are legitimately granted write access to the same path (the flaw only manifests when the operator intended read-only).
fields:
    - auid
    - uid
    - cmd
    - path
level: high

title: CVE-2026-18171 Sandbox Mount Metadata Enumeration
id: 9e1c7f42-7d4e-4f2b-9a0c-2b8d6e1f4c22
status: experimental
description: >
    Detects processes inside Docker Sandboxes reading mount metadata to derive
    the writable shared-export path behind a read-only host mount (CVE-2026-18171
    recon step).
logsource:
    product: linux
    service: auditd
detection:
    selection:
        type: SYSCALL
        syscall: openat
        path|endswith:
            - /proc/self/mountinfo
            - /proc/mounts
        key: sandbox_mountinfo
    condition: selection
level: medium

YARA Rule

rule CVE_2026_18171_sbx_readonly_mount_bypass
{
    meta:
        author = "Valters IT Threat Intelligence"
        description = "Flags Linux shell or Python scripts that enumerate virtio-fs mount metadata and probe for writable shared-export paths inside Docker Sandboxes (CVE-2026-18171 vulnerability class)."
        date = "2026-06-01"
        cve = "CVE-2026-18171"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-18171"
    strings:
        $s1 = "virtio-fs" ascii wide nocase
        $s2 = "/proc/self/mountinfo" ascii wide
        $s3 = "/proc/mounts" ascii wide
        $s4 = "policy-share" ascii wide
        $s5 = "shared-export" ascii wide
        $s6 = "O_WRONLY" ascii wide
        $s7 = "O_RDWR" ascii wide
        $s8 = ">>" ascii
        $s9 = "touch" ascii wide nocase
        $s10 = "mountpoint" ascii wide nocase
    condition:
        (uint16(0) == 0x2321 or uint32(0) == 0x7F454C46) and
        filesize < 2MB and
        $s1 and
        ($s2 or $s3) and
        1 of ($s4, $s5, $s6, $s7, $s8, $s9, $s10)
}

Suricata IDS Rule

# Network detection is a supporting control for this host-local CVE.
# Rule 1: Alert on download of exploit tooling or CVE-tagged payloads by sandbox egress.
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2026-18171 Possible Sandbox Escape Toolkit Download"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"cve-2026-18171"; nocase; classtype:attempted-admin; sid:2026181711; rev:1;)

# Rule 2: Alert on egress from the sandbox subnet to a new external destination
# (sandbox escape / data exfiltration heuristic). Replace SANDBOX_NET with the actual CIDR.
alert tcp $SANDBOX_NET any -> $EXTERNAL_NET 80,443 (msg:"CVE-2026-18171 Suspected Sandbox Egress After Mount Enumeration"; flow:established,to_server; classtype:policy-violation; sid:2026181712; rev:1;)

Elastic Detection

// EQL sequence: mount-metadata enumeration followed by a file write to a path
// mapped as a read-only host mount in Docker Sandboxes.
// Populate ${sandbox_ro_mounts} with the list of shared-export paths that
// back read-only host mounts from the platform mount policy.
sequence by process.entity_id with maxspan=5m
  [file where event.action in ("open", "read") and
     file.path : ("/proc/self/mountinfo", "/proc/mounts") and
     process.name : ("cat", "grep", "awk", "python*", "bash")]
  [file where event.action in ("modification", "creation", "overwrite") and
     file.path : ${sandbox_ro_mounts} and
     not user.name : ("root", "docker")]

Splunk SPL Query

# Query 1: Write-intent opens against the sandbox read-only mount audit key.
index=linux sourcetype=linux_audit type=SYSCALL syscall=openat key=sbx_ro_mount
| eval is_write=case(
    match(a0, "(0x4[12]$|0x241$|0x242$|0x401$)"), 1,
    true(), 0)
| where is_write=1
| stats count min(_time) as first_seen max(_time) as last_seen by host, auid, uid, cmd, exe, path
| sort - count

# Query 2: Mount metadata enumeration from inside sandbox processes (recon phase).
index=linux sourcetype=linux_audit type=SYSCALL syscall=openat
| where like(path, "%/proc/%") AND (like(path, "%mountinfo%") OR like(path, "%mounts%"))
| stats count by host, uid, cmd, path, key
| where count > 5

Wazuh OSSEC Rule

<!-- Local rules for Wazuh manager. Place in /var/ossec/etc/rules/local_rules.xml -->
<group name="docker,sandbox,">
    <!-- Base rule 80700 corresponds to auditd syscall events forwarded to Wazuh. -->
    <rule id="475772" level="12">
        <if_sid>80700</if_sid>
        <match>virtio-fs|policy-share</match>
        <description>CVE-2026-18171: sandboxed process referencing virtio-fs host-edge grant / policy-share (read-only mount bypass).</description>
        <mitre>
            <id>T1068</id>
        </mitre>
        <group>docker,sandbox,privilege_escalation,</group>
    </rule>

    <!-- Syscheck: integrity change in a directory mounted read-only into a sandbox.
         Populate the path with the actual shared-export path. -->
    <rule id="475773" level="10">
        <if_sid>550</if_sid>
        <field name="file">^/var/lib/docker-sbx/</field>
        <description>CVE-2026-18171: file modification detected below a sandbox shared-export path.</description>
        <group>docker,sandbox,fim,</group>
    </rule>
</group>

Mitigation & Patch Guidance

Patch confidence is 0/4 — the CVE is unpatched across all tracked sources, with no vendor fix, no affected-version disclosure, and no workaround published. Until upstream remediation exists, the following measures reduce exposure:

1. Immediate mitigations. Wherever possible, stop attaching host directories to Docker Sandboxes with reliance on the read-only flag as the sole protection. If a host mount is required, verify the effective access mode at the shared-export path rather than trusting the in-guest bind read-only state. Treat any sandboxed workload that receives a host mount as partially trusted: run it with the least privilege possible, apply seccomp/AppArmor/SELinux confinement to the sandbox daemon, and do not mount directories containing credentials, signing keys, or production configuration unless absolutely necessary. If a directory must be shared, prefer copy-in (snapshot or duplicated filesystem) semantics over live host mounts, and where filesystems allow it, enforce read-only at the filesystem layer rather than at the mount-option layer.

2. Patch / upgrade steps. No patch is available as of this report. Subscribe to Docker security advisories for the Sandboxes (sbx) and virtio-fs components and track the CVE for the vendor fix. When a fix is released, prioritize it above routine maintenance, since the authorization gap is trivial to exploit once the shared-export path is known. Re-test all host-mount scenarios after upgrading to confirm the read-only intent is enforced at the virtio-fs host-edge grant (access mode present in the policy-share allowlist) and not merely at the in-guest bind.

3. Long-term hardening. Enforce network egress controls on sandbox hosts to limit post-exploitation exfiltration and tool download. Instrument all sandbox hosts with auditd or equivalent (watch the shared-export paths, the audit keys referenced in the detection guidance, and mount-metadata reads from guest processes). Add syscheck/integrity monitoring for every directory that is ever mounted into a sandbox, even read-only ones. Review the sandbox policy-share allowlist at regular intervals to confirm every entry carries an explicit access mode. Finally, adopt an immutable-infrastructure posture for CI/CD and code-execution environments so that host mounts are ephemeral and disposable, minimizing the value of a writable host directory to an attacker.

References

1. National Vulnerability Database — CVE-2026-18171: https://nvd.nist.gov/vuln/detail/CVE-2026-18171
2. MITRE CWE-863 — Incorrect Authorization: https://cwe.mitre.org/data/definitions/863.html
3. MITRE ATT&CK — T1068 Exploitation for Privilege Escalation: https://attack.mitre.org/techniques/T1068/
4. Docker Security — vendor advisory pending (CNA title empty; no published advisory at time of writing): https://www.docker.com/community/resource/security/
5. CISA Known Exploited Vulnerabilities Catalog — CVE-2026-18171 is NOT listed: https://www.cisa.gov/known-exploited-vulnerabilities-catalog

No known threat-actor campaigns, exploit-in-the-wild evidence, or public PoC existence has been identified for CVE-2026-18171 at the time of this report; EPSS (0.00105) and CISA KEV status support a low immediate threat level, though the unpatched authorization flaw warrants proactive detection coverage.